Replica Backend
Builds the backend of an app clone: auth, database migrations and access rules...
Install
npx skills add Jakeschincariol/replica-skill --skill replica-backend -g -a claude-code -y- Repository
- Jakeschincariol/replica-skill7k
- Category
- Security
- Updated
- 1mo ago
- License
- MIT
- Context cost
- Lightabout 874 tokens
- Runs scripts
- No, instructions only
What it does
Builds the backend of an app clone: auth, database migrations and access rules, payments with Stripe, email, background jobs and third-party integrations through official APIs only, plus a security checklist. Use when the user says "add login", "set up auth", "wire up the database", "add payments", "connect Stripe", "add Google Calendar", "send emails", "backend for my clone", or when /replica-build is running on fake data.
replica-backend
Reads replica/architecture.md. Writes migrations and server code, and keeps
replica/backend.md (checklist below) up to date.
The rules
- Official, public APIs only, with the user's own keys. Never call the original app's private endpoints, never reuse its OAuth client, never proxy through it.
- The user creates accounts and keys. Claude never signs up for services,
never types a password, card or live key. The user creates the Stripe,
Supabase, Resend or Google Cloud project and puts keys in
.env.local. Claude writes.env.examplewith every variable name and no values. - Test mode first. Stripe test keys and test cards until replica-deploy.
Auth
- Email sign up with verification, password reset, magic link if the original has it. OAuth (Google, Apple) with the user's own developer apps.
- Sessions: http-only secure cookies. Sign out everywhere.
- Roles and teams if the recon map has them: owner, admin, member, with one function that answers "can this user do this to this record".
- Account deletion that actually deletes. Apple requires it for apps with sign up.
Database
- Migrations from
architecture.md, checked in, run by a script. - Access rules on every table: row level security policies on Supabase, or the authorisation function called in every query. Test it: a second user must get nothing back.
- Seed script with realistic fake data (no real people).
- Backups on (the host's daily backups count, check they are enabled).
